--- title: "HDFG CNA report card" url: https://radicalnotion.ai/cna/hdfg type: cna description: "HDFG is a CVE Numbering Authority with 18 published CVEs. Data-quality grade A, overall record completeness 100%." updated: 2026-11-03 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # HDFG: CNA report card - **Grade:** A - **Activity:** Active - **Published CVEs:** 18 - **CVEs in the last two years:** 18 - **In CISA KEV:** 0 - **Years active:** 0.3 - **Rank by CVE volume:** 309 of 430 - **Average CVSS:** 5.7 - **Distinct vendors:** 1 - **First CVE:** 2026-07-27 - **Latest CVE:** 2026-11-03 ## Record completeness | Field | Share of records filled | | --- | --- | | Overall | 100% | | Vendor | 100% | | Product | 100% | | CVSS | 100% | | CWE | 100% | ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 2 | | Medium | 14 | | Low | 2 | | Unscored | 0 | ## Top vendors | Vendor | CVEs | | --- | --- | | [The HDF Group](https://radicalnotion.ai/vendor/hdfgroup) | 18 | | [Microsoft](https://radicalnotion.ai/vendor/microsoft) | 14 | ## Top products | Product | CVEs | | --- | --- | | HDF5 | 18 | | azl3 hdf5 1.14.6-6 on Azure Linux 3.0 | 13 | | azl3 hdf5 1.14.6-4 on Azure Linux 3.0 | 8 | | Scale-Offset Filter | 1 | | Szip Filter | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 6 | | [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 3 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 1 | | [CWE-369](https://radicalnotion.ai/cwe/cwe-369) | Divide By Zero | 1 | | [CWE-617](https://radicalnotion.ai/cwe/cwe-617) | Reachable Assertion | 1 | | [CWE-674](https://radicalnotion.ai/cwe/cwe-674) | Uncontrolled Recursion | 1 | | [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 1 | | [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 1 | ## CVEs published by year | Year | CVEs published | | --- | --- | | 2026 | 18 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-120758 | NULL Pointer Dereference in H5HL\_unprotect via Corrupted File | medium | 5.4 | 0.1% | No | 2026-11-03 | | CVE-2026-120757 | Heap Buffer Over-read via Non-Terminated Link Data in H5L\_\_extern\_traverse | medium | 6.9 | 0.2% | No | 2026-11-03 | | CVE-2026-120756 | Heap Buffer Over-read via Malformed Message Size in HDF5's H5O\_\_chunk\_deserialize | low | 1.9 | 0.2% | No | 2026-11-03 | | CVE-2026-120755 | Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter | medium | 4.7 | 0.1% | No | 2026-11-03 | | CVE-2026-120754 | Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter | low | 1.9 | 0.1% | No | 2026-11-03 | | CVE-2026-120689 | Uncontrolled Recursion in HDF5 H5B\_\_iterate\_helper() via Crafted File | medium | 4.3 | 0.2% | No | 2026-11-02 | | CVE-2026-106547 | HDF5 heap buffer overflow in H5VM\_array\_fill via crafted fill-value metadata | high | 8.5 | 0.2% | No | 2026-10-06 | | CVE-2026-19029 | HDF5 scale-offset filter heap buffer over-read via crafted chunk | medium | 6.8 | 0.1% | No | 2026-10-06 | | CVE-2026-92627 | Heap Use-After-Free in H5T\_\_conv\_f\_f | medium | 4.6 | 0.2% | No | 2026-09-16 | | CVE-2026-19028 | HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read | medium | 6.8 | 0.2% | No | 2026-08-05 | | CVE-2026-19027 | HDF5 out-of-bounds heap read in N-Bit filter decompression | medium | 6.9 | 0.2% | No | 2026-08-05 | | CVE-2026-19026 | Nbit filter NULL/short parameter-array dereference | medium | 6.8 | 0.2% | No | 2026-08-05 | ## Frequently asked questions ### What is the HDFG CNA? HDFG is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 18 CVE records since 2026. ### How many CVEs has HDFG published? HDFG has published 18 CVE records, including 18 in the last two years. ### What is HDFG's CVE data quality grade? RadicalNotion.AI grades HDFG's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information. ### What products does HDFG publish CVEs for? HDFG most frequently publishes CVEs for HDF5, azl3 hdf5 1.14.6-6 on Azure Linux 3.0, azl3 hdf5 1.14.6-4 on Azure Linux 3.0, Scale-Offset Filter, Szip Filter. ### Which vendors does HDFG cover? HDFG publishes CVEs across 1 distinct vendors, most often The HDF Group, Microsoft. ### Is HDFG actively publishing CVEs? HDFG is currently active, based on 18 CVEs in the last two years. ### What is the average severity of HDFG's CVEs? The average CVSS base score across HDFG's scored CVEs is 5.7. ### Are any of HDFG's CVEs in CISA's Known Exploited Vulnerabilities catalog? No. None of HDFG's CVEs are currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. ### What are the most common weakness types in HDFG's CVEs? HDFG's CVEs most often map to these CWE weakness types: CWE-125 (Out-of-bounds Read), CWE-476 (NULL Pointer Dereference), CWE-416 (Use After Free), CWE-369 (Divide By Zero). ### How does HDFG rank among CNAs? By total CVE volume, HDFG ranks #309 of 430 CNAs, and it reports more complete CVE records than 55% of all CNAs. ## Peer CNAs - [Mitre](https://radicalnotion.ai/cna/mitre) (grade F, 115,570 CVEs) - [GitHub M](https://radicalnotion.ai/cna/github-m) (grade A, 22,387 CVEs) - [Patchstack](https://radicalnotion.ai/cna/patchstack) (grade A, 19,405 CVEs) - [Linux](https://radicalnotion.ai/cna/linux) (grade D, 18,219 CVEs) - [VulDB](https://radicalnotion.ai/cna/vuldb) (grade A, 17,876 CVEs) - [Microsoft](https://radicalnotion.ai/cna/microsoft) (grade D, 15,956 CVEs) - [Oracle](https://radicalnotion.ai/cna/oracle) (grade D, 12,397 CVEs) - [Wordfence](https://radicalnotion.ai/cna/wordfence) (grade A, 12,104 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/cna/hdfg). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.